roadtx OAuth Token Abuse for Microsoft Graph Access Without MFA (CVE-2025-0309)

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•8

Detects the use of the RoadTx tool to perform a Resource Owner Password Credential (ROPC) grant against Microsoft Graph while bypassing MFA. This behavior leverages CVE-2025-0309 by abusing hidden Conditional Access exclusions for specific client IDs, resulting in an authentication token issued without an MFA claim.